How to solve the catch 22 of storing my rclone password/salt in vaultwarden, and my vaultwarden backups being encrypted by my rclone password/salt? reddit / selfhosted ---------------------------------------------------------------------- amiscrewingup · 2023-12-18 16:19 Title says it all mostly. I use vaultwarden for all my passwords, etc. I have rclone set up to store my entire vaultwarden config/db/etc. every night in B2. But that rclone remote is also encrypted. Any thoughts / strategies on how to handle complete worst case scenario, where my primary goes does, my phone that has the latest cache of passwords becomes inacesssible, and all I have left is my encrypted rclone remote? haha. I recognize this is a contrived example, but I am interested in how folks handle this kind of thing, even if just for the sake of the conversation. ---------------------------------------------------------------------- Go_F1sh · 2023-12-18 16:28 paper copy ---------------------------------------------------------------------- autogyrophilia · 2023-12-18 16:32 \- Paper \- [this](https://i.kym- cdn.com/entries/icons/original/000/030/110/xmen.jpg) ---------------------------------------------------------------------- IceOleg · 2023-12-18 16:36 In addition to a paper copy... I build what I call a "Digital Emergency Kit". It's a zip of all the most important stuff - password DB, LUKS header backups, secrets, recovery codes, and a README with basic pointers on how stuff is set up. I use a `Makefile` to build the zip file. Syncthing distributes a copy to all my devices, and I upload it to several locations in addition. Hopefully it's in enough places that I can access it if needed. ---------------------------------------------------------------------- Docccc · 2023-12-18 16:45 that sounds like a security risk ---------------------------------------------------------------------- purepersistence · 2023-12-18 17:50 Backup your vault which you should do anyway. I put it unencrypted on a veracrypt volume. The only thing on the emergency sheet is the veracrypt password. ---------------------------------------------------------------------- BAAAASS · 2023-12-18 17:55 Write or print the 64 char (or more) passphrase in two parts/halves on two pieces of paper. Then keep one half in your own safe and the other half in parents or friend's safe. This way, any one stolen copy is useless, and a new set can be generated. If you are properly paranoid you can also split in 3 or more. ---------------------------------------------------------------------- dcabines · 2023-12-18 17:58 Put your passwords and whatever else into a tar archive, split it into [horcruxes](https://github.com/jesseduffield/horcrux), save each piece to an micro SD card, distribute them to [trusted keepers](https://www.amazon.com/dp/B08NCBM66B). Make it so you distribute more pieces than you need to recombine them. Now you just have to remember where at least a few of them are located for recovery. Good luck! ---------------------------------------------------------------------- k2kuke · 2023-12-18 18:05 Voldemort logic right here. I’m loving this! ---------------------------------------------------------------------- AlteRedditor · 2023-12-18 18:29 Thank you You Who Shall Not Be Named! ---------------------------------------------------------------------- IceOleg · 2023-12-18 18:45 Everything is encrypted, I've thought this through. ---------------------------------------------------------------------- martimcbro · 2023-12-18 19:02 I was thinking about the same problem some time ago and came to the conclusion to cancel my vaultwarden setup and move my passwords to the official bitwarden server (free account). This was an option for me since I did not really need the features of the paid account. Also the data should be end to end encrypted anyway. Moreover I had the impression that a company like bitwarden can guarantee security better than I can with my selfhosted setup. You could also setup rclone including your password/salt on another machine (laptop/phone). So it would need two devices to break at the same time before your rclone becomes inaccesible. ---------------------------------------------------------------------- vlad_h · 2023-12-18 19:52 Here is a simple solution I use. Use a pass phrase for your encrypted backups, memorize it, and don’t store it anywhere. Done. ---------------------------------------------------------------------- Square_Lawfulness_33 · 2023-12-18 19:59 Open a bank vault and write down your master passwords and put them there. ---------------------------------------------------------------------- adamshand · 2023-12-18 20:31 The Bitwarden desktop/phone clients keep a full copy of all your passwords even if the server is down. I haven't experimented with what the limits of this are, but have relied on it a couple times when I've needed something and didn't have internet access. If you want something in addition that that what I would do is stick a PGP (or Keepass) encrypted file on a VPS somewhere. Use that to keep any secrets that are required to get other secrets. :-) ---------------------------------------------------------------------- rymn · 2023-12-18 20:48 Piece of paper in lockbox at your local bank ---------------------------------------------------------------------- RecursiveIterator · 2023-12-18 20:51 The Vaultwarden database is already encrypted **by the Bitwarden clients** using it - you don't have to (and shouldn't) rely on the second layer of encryption for security. There is no catch 22. ---------------------------------------------------------------------- CobblerYm · 2023-12-18 21:17 Paper is the right answer. I've got master passwords and keys written down on paper and stored in a safe. I've also got instructions on how to even get to my vaultwarden (or its offsite backups) since a password does no good if you don't know where the service is. Only two people besides myself know the code to my safe, my Wife and a trusted friend who lives across the country. There are also instructions on how to access my safe (including my safe code) in my Mom's safe in a sealed envelope. ---------------------------------------------------------------------- razorpolar · 2023-12-18 21:23 That’s really cool, thanks for sharing ---------------------------------------------------------------------- autogyrophilia · 2023-12-18 21:30 Something very memorable to you but gibberish to anyone else its also a good option. My old master was something alike "exiled to the lagoon to build a more fair and equitable society" In reference to this relatively obscure podcast, minute 37:50 https://www.youtube.com/watch?v=7w056-RV-3s ---------------------------------------------------------------------- ech1965 · 2023-12-18 21:44 use you bank account as password ( hidden in plain sight ) ;-) ---------------------------------------------------------------------- Bug0 · 2023-12-18 21:54 Thank you for the links, because otherwise I would have thought this is satire ---------------------------------------------------------------------- [deleted] · 2023-12-18 22:19 [removed] ---------------------------------------------------------------------- wegwerfennnnn · 2023-12-18 22:32 How do you ensure you remember the encryption password? ---------------------------------------------------------------------- VettedBot · 2023-12-18 23:51 Hi, I’m Vetted AI Bot! I researched the **QPS Large Time Capsule to Bury for Kids A Keepsake for Your Future Self Airtight Waterproof Underground Storage Container** and I thought you might find the following analysis helpful. **Users liked:** * Students find time capsule activity engaging (backed by 3 comments) * Time capsule provides opportunity for sentimental connection (backed by 3 comments) * Durable design suitable for long-term storage (backed by 2 comments) **Users disliked:** * Product is poorly constructed (backed by 5 comments) * Product does not meet expectations (backed by 3 comments) * Product lacks proper packaging (backed by 1 comment) If you'd like to **summon me to ask about a product**, just make a post with its link and tag me, [like in this example.](https://www.red dit.com/r/tablets/comments/1444zdn/comment/joqd89c/) This message was generated by a (very smart) bot. If you found it helpful, let us know with an upvote and a “good bot!” reply and please feel free to provide feedback on how it can be improved. *Powered by* [*vetted.ai*](http://vetted.ai/reddit) ---------------------------------------------------------------------- TuhanaPF · 2023-12-19 00:22 That'll be a hassle if you give out your bank account number a lot for people to transfer money to you. ---------------------------------------------------------------------- alter3d · 2023-12-19 06:10 You can also also leverage several memorable things to you where one is relatively easy to remember and the other can be in plain sight. For example, books have been used as cipher keys for millenia. Pick a memorable book, and a memorable number, and devise some scheme to use the numbers to pick words from the book. e.g. book -- A Tale of Two Cities number -- 867-5309 scheme -- for each digit N in the number, pick the Nth word from Nth paragraph from the Nth chapter (all modulo N) and append, without a space, the numerical digits for the number of words that occur in that chapter before a punctuation mark, left-padded to 3 digits with N as a placeholder. Insert a space between each word+number. result -- 8th chapter, 8th paragraph, 8th word is "by". There are 6 words before a comma, 6 is a single digit so we pad with "88" to get 3 digits, so we have "by886" 6th chapter, 6th paragraph, 6th word is "here". 10 words before punctuation, pad with a 6 to get "here610". 7th chapter, 7th paragraph, 7th word is "scene". 1 word before punctuation, pad it and we get "scene771". and so on until we get the passphrase "by886 here610 scene771 ....." It's easy enough to remember a number, and you can hide the book in plain sight (assuming you have a decent bookshelf), and generating numbers at the ends of words foils dictionary attacks. There are any number of derivation schemes you can come up with... you can pair numbers so that the first one is chapter and the second is paragraph, you can select pages, whatever. This also lets you do a version of an M of N recovery process. You give your mom the book + number. Give your best friend number + the generation scheme. Give your partner the book + generation scheme. Don't tell them who has the other parts (and ideally, make it hard to guess who it might be), and in your will or whatever you list them, and as long as 2 of the 3 are around, your key can be generated. You can even split up the generation scheme into smaller blocks and distribute that in parts to increase the number of people that would need to collude. ---------------------------------------------------------------------- Fed-Poster-1337 · 2023-12-19 06:31 lol @ "Q) This isn't really in line with how horcruxes work in the harry potter universe! A) It's pretty close! You can't allow any one horcrux to be used to resurrect the original file (and why would you that would be useless) but you can allow two horcruxes to do it (so only off by one). Checkmate HP fans." ---------------------------------------------------------------------- IceOleg · 2023-12-19 07:56 We are back to the chicken and egg! My KeePass database is available in the same place*. I use the password database all the time, so I doubt I will forget the password to that. The emergency kit password is available in the password database. Additionally I have the emergency kit password on paper in a safe place. *: Everything is in the same 7zip file. Inside is the KeePass database which is not encrypted by 7zip (only by KeePass itself). The rest is in a tar file which is encrypted by 7zip. 7zip can apply encryption per file, which is neat. That means I only have one file to deal with. ---------------------------------------------------------------------- ZAFJB · 2023-12-19 15:57 Add a third password storage somewhere. Paper and/or electronic. ---------------------------------------------------------------------- Wojojojo90 · 2023-12-19 17:25 Out of curiosity, how are you getting access to the encrypted rclone remote in this hypothetical situation where your primary goes down and you also can't access passwords on your phone? Are you putting your rclone remote on a publicly accessible bucket?